2025 CVEs (page 388)
Page 388 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-28915 | Critical | 9.1 | 2025-03-11 | Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit allows Upload a Web Shell to a Web Server.This iss… |
CVE-2025-28914 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Sharma wordpress login form to anywhere wp-show-logi… |
CVE-2025-28913 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Aftab Ali Muni WP Add Active Class To Menu Item wp-add-active-class-to-menu-item allows Cross Site Request F… |
CVE-2025-28912 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue aff… |
CVE-2025-28910 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Ravinder Khurana WP Hide Admin Bar wp-hide-admin-bar allows Cross Site Request Forgery.This issue affects WP… |
CVE-2025-28909 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in edwardw WP No-Bot Question wp-no-bot-question allows Cross Site Request Forgery.This issue affects WP No-Bot… |
CVE-2025-28908 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pipdig pipDisqus pipdisqus allows Stored XSS.This issue a… |
CVE-2025-28907 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahul Arora WP Last Modified wp-last-modified allows Stor… |
CVE-2025-28906 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thiago S.F. Skitter Slideshow wp-skitter-slideshow allows… |
CVE-2025-28905 | High | 7.1 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chaser324 Featured Posts Grid featured-posts-grid allows… |
CVE-2025-28902 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Benjamin Pick Contact Form 7 Select Box Editor Button contact-form-7-select-box-editor-button allows Cross S… |
CVE-2025-28901 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Naren Members page only for logged in users members-page-only-for-logged-in-users allows Stored XSS.This iss… |
CVE-2025-28900 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in webgarb TabGarb Pro tabgarb allows Stored XSS.This issue affects TabGarb Pro: from n/a through <= 2.6. |
CVE-2025-28897 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Steveorevo Domain Theme domain-theme allows Stored XSS.This issue affects Domain Theme: from n/a through <=… |
CVE-2025-28896 | Medium | 4.7 | 2025-03-11 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects… |
CVE-2025-28895 | High | 7.1 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suman Biswas Custom top bar custom-top-bar allows Stored… |
CVE-2025-28894 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.Th… |
CVE-2025-28892 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in a2rocklobster FTP Sync ftp-sync allows Stored XSS.This issue affects FTP Sync: from n/a through <= 1.1.6. |
CVE-2025-28891 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in jazzigor price-calc price-calc allows Stored XSS.This issue affects price-calc: from n/a through <= 0.6.3. |
CVE-2025-28887 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Fastmover Plugins Last Updated Column plugins-last-updated-column allows Cross Site Request Forgery.This iss… |
CVE-2025-28886 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in xjb REST API TO MiniProgram rest-api-to-miniprogram allows Cross Site Request Forgery.This issue affects RES… |
CVE-2025-28884 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Kumar WP Bulk Post Duplicator wp-bulk-post-duplicator allows Cross Site Request Forgery.This issue af… |
CVE-2025-28883 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Martin WP Compare Tables wp-compare-tables allows Stored XSS.This issue affects WP Compare Tables: from n/a… |
CVE-2025-28881 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in mg12 Mobile Themes wp-mobile-themes allows Cross Site Request Forgery.This issue affects Mobile Themes: from… |
CVE-2025-28879 | Medium | 6.5 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aumsrini Bee Layer Slider bee-layer-slider allows Stored… |
CVE-2025-28878 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will Brubaker Awesome Surveys awesome-surveys allows Stor… |
CVE-2025-28876 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Skrill_Team Skrill Official official-skrill-woocommerce allows Cross Site Request Forgery.This issue affects… |
CVE-2025-28875 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templat… |
CVE-2025-28874 | Medium | 6.5 | 2025-03-11 | Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Exploiting Incorrectly Con… |
CVE-2025-28872 | Medium | 5.3 | 2025-03-11 | Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained… |
CVE-2025-28871 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-r… |
CVE-2025-28870 | Medium | 6.5 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm amocrm-webform allows DOM-Based XSS… |
CVE-2025-28868 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in ZipList ZipList Recipe ziplist-recipe-plugin allows Cross Site Request Forgery.This issue affects ZipList Re… |
CVE-2025-28867 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in stesvis Frontpage category filter frontpage-category-filter allows Cross Site Request Forgery.This issue aff… |
CVE-2025-28866 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger login-logger allows Cross Site Request Forgery.This issue affects Login Logger: from… |
CVE-2025-28864 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This i… |
CVE-2025-28863 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Carlos Minatti Delete Original Image delete-original-image allows Cross Site Request Forgery.This issue affe… |
CVE-2025-28862 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Comment Date and Gravatar remover remove-date-and-gravatar-under-comment allows Cross Site Request… |
CVE-2025-28861 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker wpjqp-datepicker allows Stored XSS.This issue affects WP jQuery Persian D… |
CVE-2025-28860 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator google-news-editors-picks-news-feeds allows Stored XSS… |
CVE-2025-28859 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in CodeVibrant Maintenance Notice maintenance-notice allows Cross Site Request Forgery.This issue affects Maint… |
CVE-2025-28857 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration rankchecker-io-integration allows Stored XSS.This issue affects Rankc… |
CVE-2025-28856 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.Thi… |
CVE-2025-27181 | High | 7.8 | 2025-03-11 | Substance3D - Modeler versions 1.15.0 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context o… |
CVE-2025-27180 | Medium | 5.5 | 2025-03-11 | Substance3D - Modeler versions 1.15.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An att… |
CVE-2025-27173 | High | 7.8 | 2025-03-11 | Substance3D - Modeler versions 1.15.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in t… |
CVE-2025-21170 | Medium | 5.5 | 2025-03-11 | Substance3D - Modeler versions 1.15.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-servic… |
CVE-2025-0900 | Low | 3.3 | 2025-03-11 | PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-2207 | Low | 2.4 | 2025-03-11 | A vulnerability classified as problematic was found in aitangbao springboot-manager 3.0. This vulnerability affects unknown code of the file /sys/dept. The man… |
CVE-2025-2206 | Low | 2.4 | 2025-03-11 | A vulnerability classified as problematic has been found in aitangbao springboot-manager 3.0. This affects an unknown part of the file /sys/permission. The man… |
CVE-2025-27789 | Medium | 6.2 | 2025-03-11 | Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression name… |
CVE-2025-25929 | Medium | 5.4 | 2025-03-11 | A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute ar… |
CVE-2025-25928 | High | 8.0 | 2025-03-11 | A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via… |
CVE-2025-25927 | Medium | 6.8 | 2025-03-11 | A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request. |
CVE-2025-25925 | Medium | 4.8 | 2025-03-11 | A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted p… |
CVE-2025-23360 | High | 7.1 | 2025-03-11 | NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successful exploit of this v… |
CVE-2025-23243 | Medium | 6.5 | 2025-03-11 | NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data t… |
CVE-2025-23242 | High | 7.3 | 2025-03-11 | NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to escala… |
CVE-2025-27773 | High | 8.6 | 2025-03-11 | The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion a… |
CVE-2025-27591 | Medium | 6.8 | 2025-03-11 | A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This cou… |
CVE-2025-27440 | High | 8.5 | 2025-03-11 | Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2025-27439 | High | 8.5 | 2025-03-11 | Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2025-27179 | Medium | 5.5 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-s… |
CVE-2025-27178 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-27177 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-27176 | Medium | 5.5 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-s… |
CVE-2025-27175 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-27174 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-27171 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-27170 | Medium | 5.5 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service… |
CVE-2025-27169 | High | 7.8 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-27168 | High | 7.8 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-27167 | High | 7.8 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs… |
CVE-2025-27166 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-27164 | Medium | 5.5 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure… |
CVE-2025-27163 | Medium | 5.5 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure… |
CVE-2025-27162 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result… |
CVE-2025-27161 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, w… |
CVE-2025-27160 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-27159 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-27158 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result… |
CVE-2025-26701 | Critical | 10.0 | 2025-03-11 | An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, an… |
CVE-2025-25749 | High | 7.1 | 2025-03-11 | An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies. |
CVE-2025-25748 | High | 7.3 | 2025-03-11 | A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords)… |
CVE-2025-24453 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-24452 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-24451 | High | 7.8 | 2025-03-11 | Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2025-24450 | High | 7.8 | 2025-03-11 | Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2025-24449 | Medium | 5.5 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-24448 | Medium | 5.5 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-24445 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-24444 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-24443 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-24442 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-24441 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-24440 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-24439 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-24431 | Medium | 5.5 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure… |
CVE-2025-24201 | Critical | 10.0 | 2025-03-11 | An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15… |
CVE-2025-0151 | High | 8.5 | 2025-03-11 | Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |